Bug 717378

Summary:	Backport getaddrinfo workaround
Product:	Red Hat Enterprise Linux 6	Reporter:	Simo Sorce <ssorce>
Component:	krb5	Assignee:	Nalin Dahyabhai <nalin>
Status:	CLOSED ERRATA	QA Contact:	BaseOS QE Security Team <qe-baseos-security>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	6.1	CC:	dpal, jplans, prc
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	krb5-1.9-13.el6	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:
Clones:	733675 (view as bug list)		Environment:
Last Closed:	2011-12-06 17:36:59 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Bug Depends On:
Bug Blocks:	733675

Description Simo Sorce 2011-06-28 17:46:46 UTC

getaddrinfo() apparently does PTR lookups if anything but AF_UNSPEC is set for the family.
In krb5_snam_to_principal() AF_INET was used and this causes PTR requests to be done even when rdns = false is set in krb5.conf
Moreover checking PTR records yields wrong canonicalization on networks where PTR records are wrong and can't be easily fixed.

This caused issues on a customer network.

Upstream has fixed this issue with ticket #6922
Commit: http://src.mit.edu/fisheye/changelog/krb5/?cs=24977

It would be nice to backport this fix asap.

Upstream bug #6923 is also related, but not critical so backporting can be postponed if considered too risky.

Comment 4 errata-xmlrpc 2011-12-06 17:36:59 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2011-1707.html